Getting Data In

Files and directories - remote

The easiest way to get your logs from remote machines into Splunk is with the universal forwarder. You set up the forwarder on the machine generating the logs and then point the forwarder at the Splunk indexer. The forwarder monitors the logs and forwards the events to the indexer, which then indexes them and makes them available for searching.

There are two main steps:

1. Set up the forwarder on the remote machine and point it at the indexer. See this recipe: "Forwarders".

2. Set up the forwarder's inputs so that they monitor the logs. You set up the inputs on the forwarder the same as if they were on a Splunk indexer. However, the forwarder has no Splunk Web, so you must set up the inputs either with the CLI or by editing inputs.conf directly.

For information on setting up inputs to monitor Unix logs, see "Monitor files and directories" in this manual. For additional information on how to set up forwarders, see "Use forwarders" in this manual.